{"record":{"id":"4a4dc9e995b28afa","repo":"quarkusio/quarkus","slug":"no-certificate-found-with-alias-alias","errorCode":null,"errorMessage":"No certificate found with alias: <alias>","messagePattern":"No certificate found with alias: <alias>","errorType":"exception","errorClass":"KeyStoreException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/cli/src/main/java/io/quarkus/tls/cli/GenerateCACommand.java","lineNumber":101,"sourceCode":"    private boolean hasExpired() throws Exception {\n        var cert = getCertificateFromPKCS12();\n        try {\n            cert.checkValidity();\n        } catch (Exception e) {\n            LOGGER.info(\"🔥 Certificate has expired. Renewing...\");\n            return true;\n        }\n        return false;\n    }\n\n    private static X509Certificate getCertificateFromPKCS12()\n            throws IOException, KeyStoreException, CertificateException, NoSuchAlgorithmException {\n        try (FileInputStream fis = new FileInputStream(KEYSTORE_FILE)) {\n            KeyStore keystore = KeyStore.getInstance(\"PKCS12\");\n            keystore.load(fis, \"quarkus\".toCharArray());\n            Certificate cert = keystore.getCertificate(CaGenerator.KEYSTORE_CERT_ENTRY);\n            if (cert == null) {\n                throw new KeyStoreException(\"No certificate found with alias: \" + CaGenerator.KEYSTORE_CERT_ENTRY);\n            }\n            return (X509Certificate) cert;\n        }\n    }\n\n}\n","sourceCodeStart":83,"sourceCodeEnd":108,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/cli/src/main/java/io/quarkus/tls/cli/GenerateCACommand.java#L83-L108","documentation":"GenerateCACommand (quarkus tls generate-ca CLI) reads the local quarkus.keystore.p12 PKCS#12 file with password \"quarkus\" and fetches the certificate under the well-known alias CaGenerator.KEYSTORE_CERT_ENTRY. If getCertificate returns null the alias is absent and a KeyStoreException is thrown.","triggerScenarios":"Running the CA generation/cert command when the keystore file exists but lacks the expected alias — e.g. a corrupted, truncated, or manually replaced keystore; a failed prior generate step that created an empty keystore.","commonSituations":"Interrupted first-run dev services key generation; deleting/regenerating certs by hand; stale keystore from an older Quarkus version with a different alias.","solutions":["Delete the existing quarkus.keystore.p12 and rerun the generation command so it is recreated with the correct alias.","List aliases (keytool -list -keystore quarkus.keystore.p12 -storepass quarkus) to confirm which entries actually exist.","Ensure nothing (editor, antivirus, concurrent build) corrupts the keystore; regenerate after a partial failure.","Check you are using the matching Quarkus CLI version whose expected alias matches the keystore contents."],"exampleFix":"// before: stale keystore missing alias\n$ quarkus tls generate-ca  // throws: No certificate found with alias: quarkus\n\n// after: regenerate from scratch\n$ rm quarkus.keystore.p12\n$ quarkus tls generate-ca","handlingStrategy":"fallback","validationCode":"// check alias before running dependent commands\nKeyStore ks = KeyStore.getInstance(\"PKCS12\");\ntry (FileInputStream fis = new FileInputStream(\"quarkus.keystore.p12\")) {\n  ks.load(fis, \"quarkus\".toCharArray());\n}\nif (ks.getCertificate(\"quarkus\") == null) {\n  // delete keystore and regenerate\n}","typeGuard":null,"tryCatchPattern":"try {\n  X509Certificate cert = GenerateCACommand.getCertificateFromPKCS12();\n} catch (KeyStoreException e) {\n  // regenerate: delete quarkus.keystore.p12 and rerun quarkus tls generate-ca\n}","preventionTips":["After any interrupted key generation, delete quarkus.keystore.p12 and regenerate instead of reusing it.","Verify keystore contents with keytool -list before running cert-dependent commands.","Keep keystore generation in a single idempotent step of your dev setup script."],"tags":["quarkus","tls","keystore","certificate","cli"],"backgroundTag":"missing-certificate-alias","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}